VA Data Security Form

NU IRB Project Number: STU

UIC Protocol Number:

Northwestern University – Institutional Review Board Research Data Security Form Biomedical: Institutional Review Board Office, Rubloff, 7th Floor, 750 N. Lake Shore Drive, Chicago, IL 60611 Social/Behavioral: Institutional Review Board Office, Hogan, G100-6th Floor, 2205 Tech Drive, Evanston, IL 60208.

For ease of submission, please submit this form electronically:  Upload the document directly into eIRB by submitting a revision. The form can be uploaded in both Word or PDF formats.

HANDWRITTEN FORMS WILL NOT BE ACCEPTED. 1. Completion date: 2. Principal Investigator Name: 3. Submission Prepared By: 4. Project Title:

5. Type of Protocol Biomedical Social/Behavioral Science

6. Data Security and Management:

A. In what format will information be maintained? Please select all applicable formats: Paper Electronic Stored specimens * Recording media

B. What safeguards are in place to prevent disclosure of information?

Electronic Data Please select all that apply: De-identified data only (no personal identifiers are included/linked to the data) Password access Coded; the master list is secured and stored separately Data will be encrypted (specify encryption software) Data will be stored on a secure network server Stand alone desktop/laptop computer will be used to store data Not connected to server/internet An organization outside of the NU covered entity will store the key code. Other (specify): Not applicable

Research Data Security (Version 2, September 2011) Page 1 of 3 Hardcopy data and recordings and specimens* Please select all that apply: De-identified (no personal identifiers are included/linked to the data) Coded; the master list is secured and stored separately Locked file cabinet Locked office/lab Locked suite

Locked refrigerator/freezer* Specimens coded with a master list that is secured and kept separately* Other (specify): Not applicable

Electronic Portable Devices Indicate below whether or not data will be hosted at any time, even temporarily, on electronic portable devices (e.g., laptops, Personal Digital Assistant (PDA), smart phones, mp3 players, external hard drives).

Note: only the “minimal data necessary” should be stored on portable devices

Personal or private identifiable data WILL NOT be stored on portable devices. Personal or private identifiable data WILL be stored on portable devices. Note: PHI stored in this manner must be encrypted

Please provide a rationale for keeping personal or private identifiable data on electronic portable devices:

Indicate the physical location for data storage:

C. Data sharing outside NU Other than NU investigators and research staff noted in the Authorized Personnel application page, indicate who will have access to the data or specimens during the course of the research study. Check all that apply: Statistician Colleague(s) / collaborator(s) Other research laboratories Study data coordinating center Consultants Data, tissue, specimen registry Sponsor/funding agency Other (specify):

How will the data be shared or disclosed? Without any identifiers With identifiers (PHI) With a linked code

Identify who will have access to the key code:

Research Data Security (Version 2, September 2011) Page 2 of 3 How will data be transferred (e.g. courier, mail) or transmitted electronically to prevent unauthorized access? Check all that apply: Overnight courier US Postal Service Transmitted over a secure network (specify): Transmitted over a public network, PHI must be encrypted (specify): Via e-mail, PHI must be encrypted (specify): Other (specify): Not applicable

NOTE: Telefaxing of identifiable data is not allowed. Describe the plans for destruction/removal of identifiers. End of study years after study completion Other (specify):

Note: If this is VA research, destruction of identifiers is prohibited.

D. Planned data/specimen retentions/disposition at study completion If personal or private information will either be kept with the data and/or specimens, or data or specimens will be coded after the study is completed, please provide the following information (check all that apply):

All data files will be stripped of personal or private identifiers and/or the key to the code destroyed The de-identified data will be maintained indefinitely under the supervision of the Principal Investigator. Explain: The de-identified data will be added to an existing data bank/repository. Explain and specify Principal Investigator, protocol title and STU number: All specimens will be stripped of personal or private identifiers and the key to the code will be destroyed The de-identified specimens will be maintained indefinitely under the supervision of the Principal Investigator. Explain: Specimens will be added to an existing IRB approved bank/repository. Explain and specify Principal Investigator, protocol title and STU number: Audio or video recordings will be transcribed and then destroyed or modified to eliminate the possibility that study participants could be identified. Personal or private identifiers and/or codes linking the data and/or specimens to identifiers will be maintained in a secure manner only to fulfill a sponsor agreement and/or regulatory requirements, but no future research will be conducted. Explain and specify the custodian: Personal or private identifiers and/or coded linking the data and/or specimens will be maintained for future research purposes. The coded data/specimens will be maintained indefinitely under the supervision of the Principal Investigator. Explain and specify Principal Investigator, protocol title and STU number: The Principal Investigator will maintain the master link and the data specimens will be added to an existing IRB approved bank repository. Explain and specify Principal Investigator, protocol title and STU number: Other (specify):

Research Data Security (Version 2, September 2011) Page 3 of 3